1# drmserver - DRM service
2type drmserver, domain;
3type drmserver_exec, exec_type, file_type;
4
5init_daemon_domain(drmserver)
6typeattribute drmserver mlstrustedsubject;
7
8net_domain(drmserver)
9
10# Perform Binder IPC to system server.
11binder_use(drmserver)
12binder_call(drmserver, system_server)
13binder_call(drmserver, appdomain)
14binder_service(drmserver)
15
16# Perform Binder IPC to mediaserver
17binder_call(drmserver, mediaserver)
18
19allow drmserver sdcard_type:dir search;
20allow drmserver drm_data_file:dir create_dir_perms;
21allow drmserver drm_data_file:file create_file_perms;
22allow drmserver tee_device:chr_file rw_file_perms;
23allow drmserver app_data_file:file { read write getattr };
24allow drmserver sdcard_type:file { read write getattr };
25r_dir_file(drmserver, efs_file)
26
27type drmserver_socket, file_type;
28
29# /data/app/tlcd_sock socket file.
30# Clearly, /data/app is the most logical place to create a socket.  Not.
31allow drmserver apk_data_file:dir rw_dir_perms;
32type_transition drmserver apk_data_file:sock_file drmserver_socket;
33allow drmserver drmserver_socket:sock_file create_file_perms;
34allow drmserver tee:unix_stream_socket connectto;
35# Delete old socket file if present.
36allow drmserver apk_data_file:sock_file unlink;
37
38# After taking a video, drmserver looks at the video file.
39r_dir_file(drmserver, media_rw_data_file)
40
41# Read resources from open apk files passed over Binder.
42allow drmserver apk_data_file:file { read getattr };
43allow drmserver asec_apk_file:file { read getattr };
44
45# Read /data/data/com.android.providers.telephony files passed over Binder.
46allow drmserver radio_data_file:file { read getattr };
47
48# /oem access
49allow drmserver oemfs:dir search;
50allow drmserver oemfs:file r_file_perms;
51
52allow drmserver drmserver_service:service_manager { add find };
53allow drmserver permission_service:service_manager find;
54
55selinux_check_access(drmserver)
56